New design for o2platform blog and links to post categories

UPDATE: See also New design for this blog

I just spent some time at the O2 Blog where I selected a new theme and categorized all 80 posts.

See image below for the new look, or visit http://o2platform.wordpress.com/ directly (please let me know what you think of).

Details of Today's O2 Spring-MVC focused webcast

Hi, in case you want to join in, here are the are the main links for today's event (Analysing a Spring MVC App (JPetStore) using the OWASP O2 Platform)

• The webcast is done using join.me and you can access it by visiting this link: https://join.me/135-208-702
• You can download the demo files from here: http://s3.amazonaws.com/Demo_Files/jPetStore%20-%20O2%20Demo%20Pack.zip
• If you haven't installed O2, now would be a good time to do it: http://code.google.com/p/o2platform/downloads/list

See you at the WebCast (via https://join.me/135-208-702)

Dinis Cruz

Blog: http://diniscruz.blogspot.com
Twitter: http://twitter.com/DinisCruz
Web: http://www.owasp.org/index.php/O2

O2 Webcast: "Analysing a Spring MVC App (JPetStore) using the OWASP O2 Platform"

I just setup the following webcast at EventBrite: Analysing a Spring MVC App (JPetStore) using the OWASP O2 Platform

Couple more blog posts on JPetStore and additional Spring MVC Autobinding vulnerabilities

On the Spring MVC topic, I added a couple more blog posts and video to the O2 developer blog:

• http://o2platform.wordpress.com/2011/07/13/viewing-jpetstore-hsqldb-database-and-couple-more-autobinding-issues/
• http://o2platform.wordpress.com/2011/07/13/writing-an-o2-ie-automation-script-for-jpetstore-account-creation/ with supporting YouTube video http://www.youtube.com/watch?v=J4Ojqzb6qsw
• http://o2platform.wordpress.com/2011/07/13/injecting-firebuglite-and-jquery-into-a-ie-automation-page-jpetstore-example/
• http://o2platform.wordpress.com/2011/07/13/creating-an-api-for-jpetstore-browser-auto/

I also noticed that using the same autobinding vulnerability, it is possible to change the quantity of the item being purchased to a negative value which has interesting implications on the current purchase and more importantly on the global (to JPetStore) 'item stock quantity' value.

I have not scripted this latest issue, but if you want looking at trying these scripts, why don't you have a go at writing it?

:)

Reaching out to Spring Developers

I just posted an entry on the Spring Framework forums http://forum.springsource.org/showthread.php?111901-Security-Vulnerabilities-with-JPetStore-and-visualization-of-the-AutoBinding-Issues which hopefully will get some tracking from their side.

I will reach out to my contacts over there (Spring Source), but if you know somebody at SpringSource (or at a heavy user of Spring MVC) please put them in touch.

Thanks

Finally ... here is how I have been analysing Spring MVC apps using O2

One of the greatest challenges I always had when reviewing Spring MVC applications, was to gain a full picture of its controllers, and more importantly its CommandClasses (i.e. the POJOs that are AutoBinded by Spring and who are a common source of high/critical vulnerabilities in Spring MVC apps).

The way I approach these problems (visualizing/understanding Spring, Struts, DWR, Sharepoint, etc...), is to write scripts that consume the Application's articfacts (web.xml, *-servlet.xml, source-code, class files) and then consolidate that information in 'easy' (or easier) to undersand visualizations.

Unfortunally most of the great examples that I had in the past were built on top of Client code, so I couldn't really share them. But finally, the O2 Scripts have reached a level of maturity that it was easy to create a generic version of them for Spring's MVC Demo application: JPetStore.

"Two Security Vulnerabilities in the Spring Framework’s MVC" pdf (from 2008)

(update: see Finally ... here is how I have been analysing Spring MVC apps using O2 post for an update on how to exploit and visualize these issues using O2)

Since the Ounce website doesn't exist anymore, here is the link to the "Two Security Vulnerabilities in the  Spring Framework’s MVC" we published 3 years ago, which unfortunately it is still very relevant today.

Reaching out to .NET developers (in this case Nunit)

I just posted the text below to NUnit's main mailing list. This is something that I've wanting to do for a while, and finally I think that O2 is reaching a level of maturity that developers of other tools will find it interesting, and will adopt parts of it.

This is all part of the strategy of building bridges with developers, to add value to their world, and to allow us to speak the same language.

In this case, if we can get a good dialog with the NUnit folks, I would love to add 'security focussed Unit Tests' to the NUnit Community

"...
Hi, I'm the main developer of the OWASP O2 Platform (see http://o2platform.com and http://o2platform.wordpress.com) and I just wrote a blog post that you might find very interesting:

• Injecting O2 into another .NET Process (in this case NUnit.exe): http://o2platform.wordpress.com/2011/07/07/injecting-o2-into-another-net-process-in-this-case-nunit-exe/

O2 Platform is a .NET application that has a number of very powerful Reflection APIs. It also makes extensive use of Fluent APIs which you can see a published example here: fluentsharp.codeplex.com

As part of that PoC there is also an O2 Command Prompt that popups up which allows direct access to NUnit's Gui and memory objects. This would be very useful for NUnit developers since it would allow them to have direct access to the GUi controls without needing to recompile and execute the application.

Feel free to contact me if you have further questions or want to see a demo of this in action

Dinis
..."

Injecting O2 into another .NET Process (in this case NUnit.exe)

Here is an O2 script that I wrote while delivering O2 Training to a Company in Phoenix (as a PoC of how O2 could be further integrated into their SDL).

Check out this blog post for screenshots and the code that make this happen: http://o2platform.wordpress.com/2011/07/07/injecting-o2-into-another-net-process-in-this-case-nunit-exe/
In the past I also did the same for Fiddler, where I was able to modify its GUI and decouple a bunch of its windows.

Just to make this clear, with this technique you can take control of any .NET app and (from an O2 Script) completely manipulate its GUI (and features)

Dinis Cruz

IronJS looks very interresting

Need to take this for a test drive:

• https://github.com/fholm/IronJS
• https://github.com/fholm/IronJS/wiki
• https://github.com/fholm/IronJS/wiki/Creating-a-hosting-context
• http://ironjs.wordpress.com/
• http://newcome.wordpress.com/2010/05/25/embedding-ironjs/ and http://newcome.wordpress.com/2011/03/13/embedding-ironjs-part-ii/
• http://blog.dotsmart.net/2011/04/20/first-steps-with-ironjs-0-2/
• http://dotnet.dzone.com/articles/pumping-iron-javascript
• http://dlr.codeplex.com/

Javascript related and also interesting:

• http://newcome.wordpress.com/2010/05/08/node-net-node-js-implemented-in-javascript-on-the-net-runtime/
• http://wtfjs.com/

If you are looking for an WebAppSec job in Boston...

...here are a couple cool positions from SecurityInnovation

Posted today (1st July 2011) in http://news.ycombinator.com/item?id=2719028 by Joe Basirico ...

"...
Security Innovation's (http://securityinnovation.com) team of amazing hackers is hiring (Boston, MA).

I'm looking to hire a couple awesome security professionals for our Boston office.

We assess a wide range of really interesting technologies, from web apps to mobile to crypto. You have to have a true passion for security, most of the team does this on their off time and it's all we talk about.

If you dream in hex, clickjack for breakfast, exploit XSS, SQLi and CSRF for lunch, Buffer Overflows and Format String Vulns for Dinner and some AuthN/AuthZ hijacking for a midnight snack you're our kind of candidate.

You'll have time and budget to do research, go to and speak at conferences, and build tools that will change the internet (We helped develop Firesheep, if you remember that).

You can e-mail me directly: jbasirico at securityinnovation dot com for more information.

Check out our postings:

• http://securityinnovation.recruiterbox.com
• http://www.linkedin.com/jobs?viewJob=&jobId=171832
• http://www.linkedin.com/jobs?viewJob=&jobId=1718256

..."

14x O2 Scripts on: EC2, jQuery, VS CSProj, Notepad++ and O2 in Aspx

Here are 14 blog posts published in the last two months at the http://o2platform.wordpress.com blog covering the following topics: EC2, jQuery, VS CSProj, Notepad++ and O2 in Aspx

• Adding an O2 Menu to Notepad++ and 'listen' to menu selections
• Creating a custom version of 'O2 Quick Development Gui' environment (stand-alone and in aspx)
• Changing a reference/dll value of a VS CSproj file
• Removing C# class from C# file in multiple WSDL files
• Creating a jQuery DataTable using serialized JSON object
• Creating a jQuery jsTree using serialized JSON object
• Simple Windows UIAutomation example
• O2 Trick to complile with explict references
• Invoking jQuery from O2
• Trigger an Keypress event in IE
• New Amazon EC2 'image filtering focused' Extension Methods
• Script to view Amazon EC2 Images List
• Using the O2's Amazon EC2 API
• New Amazon EC2 .Net API 
• Solved the problem with decryping AmazonEC2 Instance's password

The ESTAPI idea

the ESTAPI (the Enterprise Security TESTING API) was an idea that pop-up a couple years ago at the OWASP AppSecEu in Poland.

Basically the idea is that what is more valuable to app/framework developers, is NOT another API that they have to bake into their product, BUT a set of Unit/Integration tests that they can use to validate what they are doing.

In this world ESAPI would be an example of what that could look like, BUT what would be the expectation is that app and framework developers implement the same 'behaviour/capability' into their code.

And then ESTAPI would be used to develop AND validate those capabilities.

Let's take a simple example: HtmlAttributeEncoding and JavascriptEncoding across the multiple ESAPI language implementation? (Java, .NET,PHP, etc...) Shouldn't ALL of them pass the same ESTAPI test? surely ALL should have the same behaviour right? (i.e. given the same input, provide the same output)

Same thing for the popular Java Frameworks (Spring, Struts, Tapestry, JSF, etc...). We should be using ESTAPI to measure (and understand) how those frameworks behave.

Of course that there are cases where the devs will chose to use the ESAPI.jar (& its dependencies), BUT my view for a while now, is that 'THAT esapi.jar' adoption should NOT be the first step in ESAPI usage. This 'adaption' COULD be one of the options later down the line, but the first step should be on a bunch of ESTAPI tests adapted to the targeted app.

What I also like about the ESTAPI idea, is that it will give drive (and push) the ESAPI team to really segment and separate the esapi.jar dependencies. Since it will be much easier (or practical) to write ESTAPI tests on single-focused JARs, with its dependencies injected (i.e. using DI)

Fluent Sharp is now available at NuGet and VS Gallery

Thanks to Daniel Brzozowski, O2's Fluent API is now available at NuGet and VS Gallery.

• NuGet Package: http://www.nuget.org/List/Packages/FluentSharp_O2
• VS Gallery: http://visualstudiogallery.msdn.microsoft.com/83b25558-5cbb-4966-bb89-ff3d65693109
• CodePlex home: http://fluentsharp.codeplex.com/

I wonder how many developers will this reach :)

FluentSharp - An API for .NET developers

Key to the OWASP O2 Platform environment is its ability to quickly write scripts and mini-tools. In fact I took that to such a level, that I now write O2 in O2 (i.e. without using VisualStudio).

At core of O2 Scripting there is an .NET development environment (by default in C# but any .NET language is supported), and since O2 is starting to be use independently by developers, I separated the O2 core into a new API which I'm calling FluentSharp (see CodePlex project http://fluentsharp.codeplex.com/):

The main http://fluentsharp.codeplex.com/ page contains an example of how this API works and the reasoning behind the 'Fluent' concept.

I expect developers to embrace this API since it can improve their productivity, while creating smaller and more readable code. The first place to start is to use FluentSharp to build Unit-Tests and Integration-Tests (which once created can be extended into Security Tests using O2 :)  )

Using O2 to exploit HacmeBank

Just posted this to the o2 mailing list:

Hi ..., no worries about being confused, O2 is VERY confusing for new users :)

On HacmeBank have you seen the O2 Scripts that automate a number of its exploits?

Here are a couple pointers for you to start:

• Main O2 page for hacmeBank: http://o2-ounceopen.com/wiki/HacmeBank
• The opensource version is here: http://code.google.com/p/owasp-hacmebank/
• O2 Scripts on HacmeBank
• http://code.google.com/p/o2platform/source/browse/trunk/#trunk%2FO2_Scripts%2F_Sample_Vulnerabilities%2FHacmeBank
• O2 BlackBox Analysis
• API with core HacmeBank functionality: http://code.google.com/p/o2platform/source/browse/trunk/O2_Scripts/_Sample_Vulnerabilities/HacmeBank/API_HacmeBank.cs
• http://o2-ounceopen.com/wiki/HacmeBank%5CUnit_Tests_for_Vulnerabilities
• http://code.google.com/p/o2platform/source/browse/trunk/O2_Scripts/_Sample_Vulnerabilities/HacmeBank/HacmeBank_BlackBox_Exploits.cs.o2see here the video of this in action http://www.youtube.com/watch?v=T2XVufhJLig&NR=1
• Here is a video on the current script that starts the local web servers: http://www.youtube.com/watch?v=vucYncGiClE&feature=related
• O2 WhiteBox/Source-Code Analysis
• http://o2-ounceopen.com/wiki/O2_.NET_AST_Scanner_-_HacmeBank_-_SQL_Injection_PoC with explanation here http://diniscruz.blogspot.com/2010/05/major-o2-milestone-complete.html . Also using this script is this BlackBox and whiteBox Poc of HacmeBank SQL injection vulnerability: http://www.youtube.com/watch?v=MdObVD53Iyg&feature=related
• http://o2-ounceopen.com/wiki/O2_.NET_AST_Scanner_-_HacmeBank_Example
• I also started writing an installer script for HacmeBank which I have not completed (see if you can complete it)

Other resources:

• Nice video on how to exploit HacmeBank WebServices using SoapUI: http://www.youtube.com/watch?v=KftIvpRk7oQ

For more ideas on where to start on O2 see http://diniscruz.blogspot.com/2010/07/o2-platform-ideas-on-where-to-start.html

Finally here is a exercise for you:

"...reuse this HacmeBank IE Automation script

public API_HacmeBank login(string userName, string password)

{

loginPage();

ie.field("txtUserName").value(userName);

ie.field("txtPassword").value(password);

ie.button("Submit").click();

return this;

}

on this script (instead of the Altoro SQLi)

http://code.google.com/p/o2platform/source/browse/trunk/O2_Scripts/_Sample_Vulnerabilities/Altoro/PoC%20-%20SQLi%20Vulns%20via%20FuzzDb%20with%20Screenshots.h2

(the SQLi script above will fuzz the login sequence and take a screenshot after each request
..."

Note that the scripts above are the ones that you will find on your local C:\O2\O2Scripts_Database\_Scripts folder

Let's Hack Google :)

Google just took another step in improving the state of their web applications: Rewarding Web Application Security Research. Kudos to them, and I hope this program is a great success.

This is a great development for WebAppSec (following on the footsteps of others like Mozilla)

Unfortunately this page also show how weak the OWASP brand is, since there is NO mention of OWASP on that page.

For the ones that keep worrying about 'abuses of the OWASP brand' , I am much more worried about the cases where it IS not used (like this one).And every-time we kick a fuzz about 'somebody XYZ is abusing the OWASP brand' is another sign we send to the outside world that we are a mess to deal with.

The way OWASP should measure success is by the opportunities that we are able to materialize. And our failures are the opportunities we miss. This was a good opportunity missed.

But we are not too late to join the party, so the interesting question is "What can we do, so that Google (and others) point to OWASP resources in pages like this?". We have good/amazing quality materials at owasp.org that could be referenced, and ideally we should also take the opportunity to add the 'how to fix it' angle (this would highlight the power that OWASP has since we can cover the: attack, detect, mitigate, fix and defend angles)

And if a new 'clean' website with only a couple owasp references is needed (with more details being provided via links to the main owasp.org website), then why don't we just do that!

Another interesting angle would be to use this type of public initiative as a sign of 'Security SDL maturity' by companies. So far, the data points to the fact that only companies that have a very solid SDL and security teams are confident enough to make this type of public statement (for example why isn't Sony doing the same thing :) ) . The Firefox crowd actually has good metrics on this (as presented at the Summit) and it would be great to explore more this concept/idea.

We need to give our clients 'scripts' not pdfs

At the end of our security engagements our 'Findings should be delivered as 'scripts', not as a big list in a pdf' (with links and screenshots). These scripts need to cover the entire spectrum of our analysis (i.e. from BlackBox to WhiteBox, from Browser Automation to Source-Code, etc...)

The scripts should allow the client (and the developers) to initially validate the findings, and then validate the fixes (or mitigations). Ideally these 'scripts' should be delivered as 'Unit Tests' and should cover a large number of exploit variations (for example for SQLi/XSS vulns, run through the respective FuzzDB payloads)

Mono team fired from Novell and Miguel starts a new company

With my O2 work focus of the last months I missed this big event (see details here http://tirania.org/blog/archive/2011/May-16.html)

There are a lot of interesting angles here (which I need to find the time to write about), and since O2 is an active used of the Mono Project, this is also a great opportunity to work together with them.

The other interesting angle is the funding and how even Mono who is a very popular and widely used project, still doesn't have a clear and easy to execute business model (which (in my view) is one of the current failings of Open Source at the moment)

Should the NHS IT Project go Open Source and what about its security?

As expected by many, the UK's NHS IT program is going downhill: http://www.computerweekly.com/blogs/public-sector/2011/05/nhs-it-system-condemned.html

I am on thread that asked the question 'should NHS be buying FOSS Code' and my initial reaction is YES!!

Here are my thoughts:

I think the FOSS (Free and Open Source Software) angle should be explored here, since if the source code of what was developed was released under a Free license the buyer (UK Gov and NHS) would have a lot more control over the technology developed.

And in a case like the NHS where one needs global standards implemented from the bottom up (i.e. adopted by each NHS practice), a core technology stack that is Free would give a LOT of independence to the local NHS practices (they could accept the 'mothership' packages or develop their own). Yes their might be some fragmentation but we would probably be much better than where we are today.

Note that the requirements of delivering such technology in such Open/Free way, would force the main/code developers to have strong engineering practices (namely in the areas of application interdependencies and deployment).

But I guess the first question is: How much FOSS is already included in this project? What technologies are they using?

I have to admit that I don't know a lot of details about this project, but it would be very weird it was all 'proprietary' technology.

Also, since my specially is Application Security, are you guys aware of any published information about the security reviews done to these applications? (my experience is that systems that 'struggle' to work as they were supposed to, are usually full of serious security vulnerabilities (since there is a moment where the mandate is '...just get it to work...' which usually means that 'application security' is moved even down on the priority scale))

More O2 Scripts on: .NET Dynamic Types, WSDL Web Services, HttpRequest Mocking for Unit Testing, .NET AST Search, Amazon EC2 and Wordpress

Here are O2 Platform developer's blog entries created in the last two weeks covering a wide range of topics:

• .NET Dynamic Types, 
• WSDL Web Services, 
• HttpRequest Mocking for Unit Testing 
• .NET AST Search
• Amazon EC2,
• Wordpress

These provide great examples of the power of O2 Scripting and the fact that I'm creating them while working on client's projects (and they are only a fraction of the scripts I wrote since there is a LOT more committed to the O2 SVN codebase (all were committed as scripts, which mean that they will be available to O2 users once the SVN rules are updated)

Script to fetch and present large number of Wordpress.com blog entries

O2 Script to automatically upload clipboard images to Wordpress.com

Trying to Decrypt Amazon EC2 password using BouncyCastle and it is not working

Scripting "O2 Tool - AST Search" to find Null references (.NET Static Analysis)

O2 Tool - AST Search (.NET Static Analysis)

Unit Test for HttpModule using Moq to wrap HttpRequest

Amazon EC2 Browser - Timer to Stop Instances

O2 Tool - Amazon EC2 Browser

Mocking HttpContext HttpRequest and HttpResponse for UnitTests (using Moq)

O2Script: Not Optimized fuzz string generator

O2 Script: consume webservices by using the WSDL's C#

O2 Script: Using Reflection to Invoke Bing Search Web Service

O2 Script: Dynamic creation of .Net Assemblies, Types, Methods, Properties and Fields

Blog posts on O2 scripts covering: JavaScript, OpenXML, GIT, PuttyGen, RDP, .NET Static Analysis

Here a couple more Blog Posts on O2 Scripting that I published recently at the O2 focused blog http://o2platform.wordpress.com:

• O2 Script: Util - Javascript Object viewer
• O2 Script: Manipulating RadioButtons
• O2 Script: Quick File Viewer
• Making HttpRequest QueryString and Form Editable
• O2 Script: loading data from an Xslx (OpenXml) file
• Decomposing an Lamba method used in an O2 Script
• O2 Script: Installing TortoiseSVN and ProcessExplorer
• O2 Script: Creating a Git Clone using TortoiseGIT
• O2 Script: adding the SSH Key to GitHub
• O2 Script: automating PuttyGen to create Public and Private Keys
• O2 Script: Automating TortoiseGit installation
• Custom O2 for .NET Static Analysis
• O2 Script: Testing for RDP server
• Running Javascript in O2's IE Automation environment

If you want a way to start on your C# based O2 scripting activities, documenting some of these scripts, would be a great activity :)  This would really help you to understand how they work.

Working with SI on Team Mentor and OWASP projects

In a model very similar to the contracts I had previously with Ounce Labs and ABN AMRO, I recently signed a professional services contract with Security Innovation

This is quite an exciting opportunity for me. Not only I'm going to be working with great people, the TeamMentor project has lots of potential and the SI guys seem very interested in O2.

Here are my areas of responsibilities (verbatim from my contract):

• TeamMentor Product Development - Taking full responsibility for the TeamMentor product
• TeamMentor Metrics - Understanding and visualizing how the product is currently used
• SI Community outreach - Representing SI in the industry
• Leadership of OWASP Projects: OWASP Exams, OWASP Certification, OWASP Academies, OWASP SDL Implementation project
• Presentations at OWASP , developer’s Conferences (TBD) or WebCasts (TBD)
• Blog and article creation
• O2 Integration with SI Product and services - Introduce SI teams to O2 capabilities and features

An interesting note, is the fact that this is one of the first times that my OWASP involvement is directly mapped into one of my contracts.

My initial focus is going to be on the TeamMentor product, which should keep me busy for the first month(s).

What is also VERY interesting 'from the point of view of Application Security', is that I am now going to be directly involved and responsible for an application's security (so if you find a vulnerability in TeamMentor please email it to me ASAP :) ).

This relationship will also (occasionally) put me in a position where I am representing an 'vendor'. This is going to force me to be very disciplined in my OWASP relationships, and I will want to take this opportunity to clarify the 'OWASP-rules-of-engagement' between commercial parties and OWASP (something that today is a very fuzzy area)

Let me know what you think of this, and (since it will change quite a bit) keep an eye on TeamMentor :)

O2 Script: DWR FunctionsViewer and Invoker

If you are using (or testing) DWR, you might find the O2 scripts I just published quite interesting and useful:

• Here is an initial blog post that explains the new GUI: http://o2platform.wordpress.com/2011/03/07/o2-script-dwr-functions-viewer-and-invoker
• Here is the API that processes the DWR Javascript interfaces and creates a number of O2 objects that allow its easy manipulation and invocation: DWR_API.cs

There are quite a number of powerful O2 techniques at play here. For example note the use of the HtmlAgilityPack to quickly fetch the details of a web page's links, or the use of Jint (Javascript Interpreter for .NET) to access the AST of the dynamically created DWR's Javascript pages (which contain the details of the java functions that can be involved on the server)

Note: DWR is a Java/Javascript AJAX-powerhouse Web Remoting technology (see http://directwebremoting.org for more details)

O2 Scripts: Adding sites to IE zone, Registy Editor, Workpress Editor, Downloading files

Recent blog posts on O2 Platform's developer's blog that show a number of O2 Scripts in action:

• Using WatiN as a browser automation engine
• O2 Method: Adding sites to IE trusted zones
• O2 Script Sequence: Creating a Windows Registry Viewer
• O2 Util: Add sites to IE trusted zone
• O2 Util: WordPress Editor 
• O2 Script: Downloading File

I'm happy to provide more details on these scripts, so just add a comment on where you have questions and I will answer it there